Lawful interception in a mobile data network with data offload at the basestation

A mobile data network comprising:

• a plurality of basestations, each basestation communicating with a corresponding antenna that transmits and receives radio signals to and from user equipment, wherein the plurality of basestations are part of a radio access network that communicates with a core network in the mobile data network;
• a first service mechanism in the radio access network that defines an existing first data path in the radio access network for non-broken out data, defines a second data path for broken out data, identifies first data received from a corresponding basestation as data to be broken out, sends the first data on the second data path, and forwards other data that is not broken out on the first data path, wherein the first service mechanism performs a first service for network messages in the radio access network based on the first data;
• a second service mechanism in the core network that monitors network messages in the core network and determines what traffic meets breakout authorization criteria and sends a message to the first service mechanism with subscriber information for the first mechanism to perform breakout sessions on the second data path;
• an overlay network that allows the first service mechanism to communicate with the second service mechanism to perform the first service;
• wherein the first service mechanism makes a breakout decision based on internet protocol (IP) data flows matching breakout conditions to perform the first service on the second data path for subscriber sessions with subscriber information from the second service mechanism;
• a lawful interception (LI) mechanism that withholds subscriber information from the first service mechanism for subscribers subject to lawful interception so the first service mechanism will not make a breakout decision for subscribers subject to lawful interception;
• wherein the LI mechanism monitors a subscriber identification (ID) at an activation of a packet data protocol (PDP) context and compares the subscriber ID with a LI subscriber list stored in the second service mechanism that contains subscribers subject to LI, and does not authorize session breakout for the subscriber ID on the LI subscriber list by the withholding of subscriber information from the first service mechanism;
• and
• wherein the LI mechanism monitors LI activation messages from an administrative function (ADMF) of a lawful interception system and adds subscriber IDs to the LI subscriber list.